The vulnerability is an OS command injection flaw in Schneider Electric PowerLogic™ P7’s network‑exposed service. It allows an attacker who has gained privileged authenticated access to inject arbitrary commands, resulting in elevated privileges and potential compromise of system integrity, confidentiality, and availability.

Schneider Electric PowerLogic™ P7 devices are affected. No specific firmware or serial versions are listed in the vendor data.

The CVSS score of 8.6 indicates high severity. EPSS data is unavailable, so the current likelihood of exploitation remains uncertain. The flaw is not listed in CISA KEV, suggesting no publicly known, active exploitation at this time. The attack vector requires a privileged authenticated user to interact with the vulnerable service, implying that an attacker must already have some level of authorized access before exploiting the command injection. If successful, the exploited commands would run with the privileges of the authenticated user, enabling broader system compromise.